PHP released urgent updates for two major vulnerabilities affecting web-facing installations running since version 5 in 2004.
Official patches are limited to versions 8.2 and newer.
Which systems are affected?
The problems affect almost all PHP installations that accept requests from the internet, starting with versions from 2004. However, official fixes have been released exclusively for versions 8.2 and later.
Attack attempts and preventive measures
Cloudflare said it had detected early attacks in progress even before details of the problems were made public. As a precautionary measure, the Finnish government website, French websites and the Port of Rotterdam website were temporarily taken offline.
Researchers from Wiz, OpenAI and Calif announced that they discovered the problems independently, partly using artificial intelligence tools.
What could the perpetrators do?
The vulnerabilities could allow unknown parties to run code on affected computers remotely or read sensitive system memory.
Instructions from the authorities
Government security agencies, such as the UK's NCSC, have warned organisations to prepare for immediate updates or isolate their systems. The FBI has also asked those who find breaches to isolate systems, retain logs and report them.
READ ALSO
CISA orders immediate fix for serious Plex Media Server security flaws
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)